|
@@ -29,6 +29,7 @@
|
|
#include <linux/personality.h>
|
|
#include <linux/personality.h>
|
|
#include <linux/init.h>
|
|
#include <linux/init.h>
|
|
|
|
|
|
|
|
+#include <asm/a.out.h>
|
|
#include <asm/uaccess.h>
|
|
#include <asm/uaccess.h>
|
|
#include <asm/pgtable.h>
|
|
#include <asm/pgtable.h>
|
|
|
|
|
|
@@ -194,6 +195,7 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs)
|
|
unsigned long som_entry;
|
|
unsigned long som_entry;
|
|
struct som_hdr *som_ex;
|
|
struct som_hdr *som_ex;
|
|
struct som_exec_auxhdr *hpuxhdr;
|
|
struct som_exec_auxhdr *hpuxhdr;
|
|
|
|
+ struct files_struct *files;
|
|
|
|
|
|
/* Get the exec-header */
|
|
/* Get the exec-header */
|
|
som_ex = (struct som_hdr *) bprm->buf;
|
|
som_ex = (struct som_hdr *) bprm->buf;
|
|
@@ -208,15 +210,27 @@ load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs)
|
|
size = som_ex->aux_header_size;
|
|
size = som_ex->aux_header_size;
|
|
if (size > SOM_PAGESIZE)
|
|
if (size > SOM_PAGESIZE)
|
|
goto out;
|
|
goto out;
|
|
- hpuxhdr = (struct som_exec_auxhdr *) kmalloc(size, GFP_KERNEL);
|
|
|
|
|
|
+ hpuxhdr = kmalloc(size, GFP_KERNEL);
|
|
if (!hpuxhdr)
|
|
if (!hpuxhdr)
|
|
goto out;
|
|
goto out;
|
|
|
|
|
|
retval = kernel_read(bprm->file, som_ex->aux_header_location,
|
|
retval = kernel_read(bprm->file, som_ex->aux_header_location,
|
|
(char *) hpuxhdr, size);
|
|
(char *) hpuxhdr, size);
|
|
|
|
+ if (retval != size) {
|
|
|
|
+ if (retval >= 0)
|
|
|
|
+ retval = -EIO;
|
|
|
|
+ goto out_free;
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ files = current->files; /* Refcounted so ok */
|
|
|
|
+ retval = unshare_files();
|
|
if (retval < 0)
|
|
if (retval < 0)
|
|
goto out_free;
|
|
goto out_free;
|
|
-#error "Fix security hole before enabling me"
|
|
|
|
|
|
+ if (files == current->files) {
|
|
|
|
+ put_files_struct(files);
|
|
|
|
+ files = NULL;
|
|
|
|
+ }
|
|
|
|
+
|
|
retval = get_unused_fd();
|
|
retval = get_unused_fd();
|
|
if (retval < 0)
|
|
if (retval < 0)
|
|
goto out_free;
|
|
goto out_free;
|